Skip to content

Commit

Permalink
Fix doc block and use a more generic error message.
Browse files Browse the repository at this point in the history
  • Loading branch information
markstory committed Jul 16, 2014
1 parent fcec8ef commit ce126ed
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 3 deletions.
4 changes: 3 additions & 1 deletion src/View/View.php
Expand Up @@ -872,14 +872,16 @@ protected function _getViewFileName($name = null) {
* @param string $file The path to the template file.
* @param string $path Base path that $file should be inside of.
* @return string The file path
* @throws \Cake\Error\Exception
*/
protected function _checkFilePath($file, $path) {
if (strpos($file, '..') === false) {
return $file;
}
$absolute = realpath($file);
if (strpos($absolute, $path) !== 0) {
throw new Error\MissingViewException(array('file' => $file));
$msg = sprintf('Cannot use "%s" as a template, it is not within any view template path.', $file);
throw new Exception($msg);
}
return $absolute;
}
Expand Down
4 changes: 2 additions & 2 deletions tests/TestCase/View/ViewTest.php
Expand Up @@ -517,7 +517,7 @@ public function testGetViewFileNames() {
/**
* Test that getViewFileName() protects against malicious directory traversal.
*
* @expectedException Cake\View\Error\MissingViewException
* @expectedException Cake\Error\Exception
* @return void
*/
public function testGetViewFileNameDirectoryTraversal() {
Expand Down Expand Up @@ -616,7 +616,7 @@ public function testGetLayoutFileNamePrefix() {
/**
* Test that getLayoutFileName() protects against malicious directory traversal.
*
* @expectedException Cake\View\Error\MissingViewException
* @expectedException Cake\Error\Exception
* @return void
*/
public function testGetLayoutFileNameDirectoryTraversal() {
Expand Down

0 comments on commit ce126ed

Please sign in to comment.